[
https://issues.apache.org/jira/browse/AVRO-1237?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13851945#comment-13851945
]
Hudson commented on AVRO-1237:
------------------------------
ABORTED: Integrated in AvroJava #411 (See
[https://builds.apache.org/job/AvroJava/411/])
AVRO-1237. C: Verify union discriminant when reading Avro data files.
Test case submitted by Michael Cooper. Michael's original fix was to
perform a bounds check in avro_value_set_branch, but I've opted for a
solution in avro_value_read. This has two benefits: the check is only
performed when reading a discriminant value from an unsafe source, and
it doesn't impose an extra burden on anyone writing their own custom
value implementations. (dcreager: rev 1551941)
* /avro/trunk/CHANGES.txt
* /avro/trunk/lang/c/src/value-read.c
* /avro/trunk/lang/c/tests/CMakeLists.txt
* /avro/trunk/lang/c/tests/avro-1237-bad-union-discriminant.avro
* /avro/trunk/lang/c/tests/avro-1237-good.avro
* /avro/trunk/lang/c/tests/test_avro_1237.c
> Avro-C segfaults when union discriminant out of bounds
> ------------------------------------------------------
>
> Key: AVRO-1237
> URL: https://issues.apache.org/jira/browse/AVRO-1237
> Project: Avro
> Issue Type: Bug
> Components: c
> Environment: Avro-C 1.7.2
> Ubuntu 12.04 x86_64
> Reporter: Michael Cooper
> Attachments:
> 0001-AVRO-1237.-C-Verify-union-discriminant-when-reading-.patch,
> 0001-Check-union-discriminant-bounds-in-both-directions.patch,
> 0001-Test-case-for-AVRO-1237.patch, avro-1237-bad-union-discriminant.avro,
> avro-1237-good.avro
>
>
> libavro will segfault when decrypting a specially crafted (or corrupted) avro
> file when the discriminant is out of bounds.
> There is already a check for < 0, but there is no upper bounds check.
> I have attached a patch that checks the bounds.
--
This message was sent by Atlassian JIRA
(v6.1.4#6159)
